(this needs to be re-done)...
- add *_HTTPS globals to ensure we can make use of newer DNS binaries
- set them appropriately in check_resolver_bins()
- parser for those scenarios in get_https_rrecord() (to be tested)
- start working on the binary format ~ RFC 3597 as fallback
- lots of temporary comments to make it better understandable
Worked so far for testssl.net, dev.testssl.sh
When testing a TLS 1.3 host s_client_options used TLS 1.3 ciphers to test
for NPN. As that is not implemented we nee dto make sure any other version
is used.
This PR ensures that --after testing whether it's a TLS 1.3-only host
where this test doesn't make any sense in the first place.
Fix for #2633
* use system with @args so that we can query the return value
* code style improved for readability
* diff shows the filtered difference
* ok instead of cmp_ok to show not the whole content of vars
This adds a unit test to compare a run against google with the supplied openssl
version vs /usr/bin/openssl .
This would fix#2626.
It looks like there are still points to clarify
* NPN output is different (bug)
* Newer openssl version claims it's ECDH 253 instead of ECDH 256.
* Newer openssl version claims for 130x cipher it's ECDH 253, via sockets it´s ECDH/MLKEM. This seems a bug (@dcooper)
A todo is also restricing the unit test to the one where openssl is being used. E.g. the ROBOT check and more aren't done with openssl. So there's no value checking this here.
In some cases OpenSSL returns an "unsupported" message rather than a "not found" message if X25519 and X448 are not supported. This commit changes the check for whether X5519 and X448 are supported for checking for either response.
